chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 - #13942
Merged
williammartin merged 1 commit intoJul 22, 2026
Conversation
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.0 to 4.37.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4.37.0...7188fc3) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
williammartin
approved these changes
Jul 22, 2026
williammartin
deleted the
dependabot/github_actions/github/codeql-action/upload-sarif-4.37.1
branch
July 22, 2026 14:28
pabrahamsson
pushed a commit
to pabrahamsson/containers
that referenced
this pull request
Aug 3, 2026
This PR contains the following updates: | Package | Update | Change | OpenSSF | |---|---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `2.96.0` → `2.97.0` | [](https://securityscorecards.dev/viewer/?uri=github.com/cli/cli) | --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@​zwick](https://github.com/zwick) in [#​13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@​zwick](https://github.com/zwick) in [#​13823](cli/cli#13823) - Add Grok skill host support by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@​malancas](https://github.com/malancas) in [#​13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@​kofuk](https://github.com/kofuk) in [#​13787](cli/cli#13787) - Fix skill picker label wrapping by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@​BagToad](https://github.com/BagToad) in [#​13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@​Solaris-star](https://github.com/Solaris-star) in [#​13927](cli/cli#13927) - Add a macOS keyring security doc by [@​williammartin](https://github.com/williammartin) in [#​13960](cli/cli#13960) - Add a code review agent skill by [@​BagToad](https://github.com/BagToad) in [#​14003](cli/cli#14003) - Establish a pull request template for scale by [@​BagToad](https://github.com/BagToad) in [#​14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@​lukewar](https://github.com/lukewar) in [#​13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@​tidy-dev](https://github.com/tidy-dev) in [#​13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@​alondahari](https://github.com/alondahari) in [#​13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@​williammartin](https://github.com/williammartin) in [#​13985](cli/cli#13985) - Harden the deployment workflow by [@​niik](https://github.com/niik) in [#​13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@​williammartin](https://github.com/williammartin) in [#​13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@​williammartin](https://github.com/williammartin) in [#​13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@​kobihikri](https://github.com/kobihikri) in [#​13886](cli/cli#13886) - Fix typos in code and documentation by [@​pstoeckle](https://github.com/pstoeckle) in [#​13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@​SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#​13900](cli/cli#13900) #####Dependencies - chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 by [@​dependabot](https://github.com/dependabot) in [#​13790](cli/cli#13790) - chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by [@​dependabot](https://github.com/dependabot) in [#​13789](cli/cli#13789) - chore(deps): bump <https://github.com/klauspost/compress> from 1.18.6 to 1.19.0 by [@​dependabot](https://github.com/dependabot) in [#​13791](cli/cli#13791) - chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 by [@​dependabot](https://github.com/dependabot) in [#​13800](cli/cli#13800) - chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 by [@​dependabot](https://github.com/dependabot) in [#​13812](cli/cli#13812) - chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by [@​dependabot](https://github.com/dependabot) in [#​13821](cli/cli#13821) - chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by [@​dependabot](https://github.com/dependabot) in [#​13801](cli/cli#13801) - chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 by [@​dependabot](https://github.com/dependabot) in [#​13832](cli/cli#13832) - chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 by [@​dependabot](https://github.com/dependabot) in [#​13813](cli/cli#13813) - chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by [@​dependabot](https://github.com/dependabot) in [#​13822](cli/cli#13822) - chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 by [@​dependabot](https://github.com/dependabot) in [#​13843](cli/cli#13843) - chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 by [@​dependabot](https://github.com/dependabot) in [#​13841](cli/cli#13841) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@​dependabot](https://github.com/dependabot) in [#​13867](cli/cli#13867) - chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by [@​dependabot](https://github.com/dependabot) in [#​13869](cli/cli#13869) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by [@​dependabot](https://github.com/dependabot) in [#​13868](cli/cli#13868) - chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 by [@​dependabot](https://github.com/dependabot) in [#​13870](cli/cli#13870) - chore(deps): bump <https://github.com/yuin/goldmark> from 1.8.2 to 1.8.4 by [@​dependabot](https://github.com/dependabot) in [#​13888](cli/cli#13888) - chore(deps): bump <https://github.com/sigstore/sigstore-go> from 1.2.1 to 1.2.2 by [@​dependabot](https://github.com/dependabot) in [#​13842](cli/cli#13842) - chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 by [@​dependabot](https://github.com/dependabot) in [#​13877](cli/cli#13877) - chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot) in [#​13933](cli/cli#13933) - chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by [@​dependabot](https://github.com/dependabot) in [#​13934](cli/cli#13934) - chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot) in [#​13936](cli/cli#13936) - chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by [@​dependabot](https://github.com/dependabot) in [#​13935](cli/cli#13935) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.22 to 0.0.23 by [@​dependabot](https://github.com/dependabot) in [#​13937](cli/cli#13937) - chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 by [@​dependabot](https://github.com/dependabot) in [#​13938](cli/cli#13938) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@​dependabot](https://github.com/dependabot) in [#​13941](cli/cli#13941) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by [@​dependabot](https://github.com/dependabot) in [#​13942](cli/cli#13942) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.13 to 1.4.14 by [@​dependabot](https://github.com/dependabot) in [#​13944](cli/cli#13944) - chore(deps): bump nodeselector/setup-apple-codesign from [`ab275d0`](cli/cli@ab275d0) to [`309922b`](cli/cli@309922b) by [@​dependabot](https://github.com/dependabot) in [#​13878](cli/cli#13878) - chore(deps): bump <https://github.com/klauspost/compress> from 1.19.0 to 1.19.1 by [@​dependabot](https://github.com/dependabot) in [#​13950](cli/cli#13950) - chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 by [@​dependabot](https://github.com/dependabot) in [#​13951](cli/cli#13951) - chore(deps): bump the codeql-actions group with 3 updates by [@​dependabot](https://github.com/dependabot) in [#​13965](cli/cli#13965) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.23 to 0.0.24 by [@​dependabot](https://github.com/dependabot) in [#​13977](cli/cli#13977) - chore(deps): bump the codeql-actions group with 3 updates by [@​dependabot](https://github.com/dependabot) in [#​13978](cli/cli#13978) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.14 to 1.4.15 by [@​dependabot](https://github.com/dependabot) in [#​13976](cli/cli#13976) - chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 by [@​dependabot](https://github.com/dependabot) in [#​13979](cli/cli#13979) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 by [@​dependabot](https://github.com/dependabot) in [#​13980](cli/cli#13980) - chore(deps): bump actions/checkout from 6 to 7 by [@​dependabot](https://github.com/dependabot) in [#​13981](cli/cli#13981) - chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 by [@​dependabot](https://github.com/dependabot) in [#​13995](cli/cli#13995) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 by [@​dependabot](https://github.com/dependabot) in [#​13996](cli/cli#13996) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 by [@​dependabot](https://github.com/dependabot) in [#​14018](cli/cli#14018) #### New Contributors - [@​lukewar](https://github.com/lukewar) made their first contribution in [#​13777](cli/cli#13777) - [@​niik](https://github.com/niik) made their first contribution in [#​13780](cli/cli#13780) - [@​kofuk](https://github.com/kofuk) made their first contribution in [#​13787](cli/cli#13787) - [@​zwick](https://github.com/zwick) made their first contribution in [#​13807](cli/cli#13807) - [@​kobihikri](https://github.com/kobihikri) made their first contribution in [#​13886](cli/cli#13886) - [@​pstoeckle](https://github.com/pstoeckle) made their first contribution in [#​13940](cli/cli#13940) - [@​Solaris-star](https://github.com/Solaris-star) made their first contribution in [#​13927](cli/cli#13927) - [@​SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) made their first contribution in [#​13900](cli/cli#13900) - [@​alondahari](https://github.com/alondahari) made their first contribution in [#​13949](cli/cli#13949) **Full Changelog**: <cli/cli@v2.96.0...v2.97.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC41LjMiLCJ1cGRhdGVkSW5WZXIiOiI0NC41LjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=--> Reviewed-on: https://codeberg.org/pabrahamsson/containers/pulls/28
1 task
tmeijn
pushed a commit
to tmeijn/dotfiles
that referenced
this pull request
Aug 11, 2026
This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.96.0` → `v2.97.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@​me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@​zwick](https://github.com/zwick) in [#​13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@​zwick](https://github.com/zwick) in [#​13823](cli/cli#13823) - Add Grok skill host support by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@​malancas](https://github.com/malancas) in [#​13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@​kofuk](https://github.com/kofuk) in [#​13787](cli/cli#13787) - Fix skill picker label wrapping by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@​BagToad](https://github.com/BagToad) in [#​13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@​Solaris-star](https://github.com/Solaris-star) in [#​13927](cli/cli#13927) - Add a macOS keyring security doc by [@​williammartin](https://github.com/williammartin) in [#​13960](cli/cli#13960) - Add a code review agent skill by [@​BagToad](https://github.com/BagToad) in [#​14003](cli/cli#14003) - Establish a pull request template for scale by [@​BagToad](https://github.com/BagToad) in [#​14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@​lukewar](https://github.com/lukewar) in [#​13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@​tidy-dev](https://github.com/tidy-dev) in [#​13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@​alondahari](https://github.com/alondahari) in [#​13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@​williammartin](https://github.com/williammartin) in [#​13985](cli/cli#13985) - Harden the deployment workflow by [@​niik](https://github.com/niik) in [#​13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@​williammartin](https://github.com/williammartin) in [#​13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@​williammartin](https://github.com/williammartin) in [#​13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@​kobihikri](https://github.com/kobihikri) in [#​13886](cli/cli#13886) - Fix typos in code and documentation by [@​pstoeckle](https://github.com/pstoeckle) in [#​13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@​SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#​13900](cli/cli#13900) #####
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps github/codeql-action/upload-sarif from 4.37.0 to 4.37.1.
Release notes
Sourced from github/codeql-action/upload-sarif's releases.
Changelog
Sourced from github/codeql-action/upload-sarif's changelog.
... (truncated)
Commits
7188fc3Merge pull request #4020 from github/update-v4.37.1-9e7c07009c8b5f69Update changelog for v4.37.19e7c070Merge pull request #4014 from github/mbg/explicit-remote-prefix3492b7eChangeREMOTE_PATH_PREFIXtoremote=3654baaMerge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix2d682acMerge pull request #4017 from github/dependabot/github_actions/dot-github/wor...23f6a50Merge pull request #4009 from github/mbg/action-state/additions1ee3c75Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...e053684Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...6803c56Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)